TCP/IP Ports and Protocols:

Transcription

1 TCP/IP Ports and Protocols Programme NPfIT DOCUMENT RECORD ID KEY Sub-Prog / Technology Office NPFIT-FNT-TO-TAR x Project Prog. Director Mark Ferrar Owner Malcolm Version 1.0 McKeating Author Phil Benn Version Date 23/08/2007 Status Approved TCP/IP Ports and Protocols: Good Practice Guidelines Crown Copyright 2005 Page 1 of 22

2 Amendment History: Version Date Amendment History /08/2006 First draft for comment 1.0 for distribution to N3SP for Network Access Control Forecast Changes: Anticipated Change When Annual Review April 2007 Reviewers: This document must be reviewed by the following. Indicate any delegation for sign off. Name Signature Title / Responsibility Date Version Malcolm IG Security Team 1.0 McKeating Manager Tim Davis Head of Information Governance 1.0 Approvals: This document requires the following approvals: Name Signature Title / Responsibility Date Version Mark Ferrar Director Of Infrastructure 1.0 Tim Davis Head of Information Governance 1.0 Distribution: Information Governance website: Crown Copyright 2006 Page 2 of 22

3 Document Status: This is a controlled document. This document version is only valid at the time it is retrieved from controlled filestore, after which a new approved version will replace it. On receipt of a new issue, please destroy all previous issues (unless a specified earlier issue is baselined for use throughout the programme). Related Documents: Ref no Doc Reference Number Title Version 1 NPFIT-SHR-QMS-PRP-0015 Glossary of Terms Consolidated.doc 13 Crown Copyright 2006 Page 3 of 22

4 Contents TCP/IP Ports and Protocols: Introduction... 5 Abstract Aims and Objectives Assumed Reader Knowledge Background Disclaimer The New NHS Network (N3) Change Control and Security Assessment Protocol Classification Scheme Common Ports and Protocols Glossary Crown Copyright 2006 Page 4 of 22

5 1 Introduction Abstract This guide provides a general source of information for the use of common application ports and protocols used with the TCP/IP or UDP/IP networking protocols. It is provided mainly to assist NHS and Non-NHS organisations in performing their own security assessments on the implementation and use of certain networked applications. It does not describe all information security considerations when utilising certain protocols, and is not intended to be an exhaustive guide or a networking standards document. You will find guidance on the known information security issues with certain network protocols, and the general level of confidentiality and integrity that could be expected when they are in use. This includes: The definition of the protocol s primary purpose. The capabilities of the protocol, and the areas in which known weaknesses may be present. 1.1 Aims and Objectives The following information provides a knowledge-based framework that will help maintain best practice values in your own organisation. In using this guide you will be conforming to best practice and therefore avoid some of the consequences of non-compliance. After completing this guide you should understand: The minimum standards applicable to the transmission of Patient Identifiable Data (PID) or other sensitive electronic information using certain network protocols. The procedures and mechanisms for the control of PID, or other sensitive electronic information (in a NHS or other healthcare environment), when using certain network protocols. Crown Copyright 2006 Page 5 of 22

6 1.2 Assumed Reader Knowledge A general familiarity with the requirement to protect patient sensitive data at all times. A basic understanding of TCP/IP, port numbers, and application protocols. Further information on network security and related matters is available from the NHS Connecting for Health Information Security website. 1.3 Background N3 is a private Wide Area Network (WAN). Connection is therefore strictly limited to authorised endpoints. All organisations wishing to make a new connection to N3 are responsible for ensuring that their connection to the WAN does not compromise the security measures already in place. N3 is a private network consisting of thousands of PCs, servers, printers and other items of equipment all acting as the nodes or endpoints on the network. Information is unencrypted when transmitted over the network therefore confidentiality of sensitive information within N3 is not assured. N3 faces numerous threats to security as a result of incompletely protected partner networks or connections to uncontrolled external networks such as the internet. These threats are continually evolving in both strength and frequency: ongoing vigilance against these threats and the maintenance of strict security standards are essential to the continuing success of N Disclaimer Reference to any specific commercial product, process or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by NHS Connecting for Health. The views and opinions of authors expressed within this document shall not be used for advertising or product endorsement purposes. Any party relying on or using, any information contained in this document, and/or relying on or using any system implemented based upon information contained in this document, should do so only after performing a risk assessment. It is important to note that a risk assessment is a prerequisite for the design of effective security countermeasures, and when completed correctly enables an NHS organisation to demonstrate that a methodical process has been undertaken which can adequately describe the rationale behind any decisions made. NHS Connecting for Health shall also accept no responsibility for any disruption to services arising as a consequence of use of a solution based upon information contained in this document. Crown Copyright 2006 Page 6 of 22

7 2 The New NHS Network (N3) The N3 infrastructure connects organisations, such as non-nhs healthcare providers and approved third-party partners, to other organisations within the NHS. Currently, this infrastructure is a managed service provided and supported by a number of contractors with British Telecom (BT) acting as service integrator. BT Consultancy & Systems Integration (BT C&SI) is delivering the National Application Service Provider (NASP) and London Local Service Provider (LSP). BT Exact (BT s IT and operations business) supplies the Data Centre hosting while British Telecom N3 Service Provider (BT N3SP) manages the N3 network BT provides certain guarantees regarding the protection of the network infrastructure this makes the network a private transport medium. The N3 infrastructure is therefore suitable for consideration as a WAN. Although the N3 network is private, it is not secure. The network is a transport mechanism for data and as such does not encrypt (or similarly protect) the data transmitted. Users of the network are required to apply such methods of information confidentiality and integrity as are appropriate to the data transmitted and the applications used. Further information on suitable levels of encryption and protection is available in the Approved Cryptographic Algorithms: Good Practice Guidelines document. 3 Change Control and Security Assessment Each protocol is measured for use in both internal and external instances. Internal means one or more local LAN segments present on a single site or campus. This would often comprise one or more of the following: local Ethernet LAN segments local Wireless LAN segments local DMZ segments dedicated point to point copper links dedicated point to point fibre optic links External means any network or communications medium which connects two or more separate LAN segments together. This encompasses the following: Point to point leased fibre or copper links i.e. LES, Frame Relay, ATM N3 Network connections Internet connections Crown Copyright 2006 Page 7 of 22

8 3.1 Protocol Classification Scheme The following classification scheme is applied to each network protocol: - The protocol is suitable for use in most instances with low information security risks - The protocol is suitable for use only in certain instances, and may introduce moderate information security risks - The protocol is not suitable for use, and may introduce significant information security risks The classifications are provided to guide a user in identifying possible characteristics or issues with regard to each protocol, however the classifications may not apply in all cases. Factors such as network architecture, data security services and the type of information transported will all affect the overall risk associated with the use of each protocol. NHS Connecting for Health recommend that users and system providers should utilise protocols that are classified as green where possible. It is recommended that when using protocols classified as yellow, users and system providers follow the recommendations or workarounds detailed with each protocol description. If protocols that are classified as red are currently in use, migration plans should be developed to phase out the use of the protocol as soon as possible. Crown Copyright 2006 Page 8 of 22

9 3.2 Common Ports and Protocols echo discard systat daytime qotd chargen 7/tcp 7/udp 9/tcp 9/udp 11/tcp 11/udp 13/tcp 13/udp 17/tcp 17/udp 19/tcp 19/udp Access to the tcp/udp simple services or small services should be disabled as part of good systems management practice. These services should only be used for debugging purposes, and disabled in all other cases. ftp-data ftp-control 20/tcp 20/udp 21/tcp 21/udp Internal: External: FTP is a clear-text communications protocol. Data is transmitted in the clear; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. FTP also transmits usernames and passwords in the clear, which could potentially compromise the security of a system. Secure alternatives such as SCP or Secure FTP should be used as a replacement for FTP. ssh 22/tcp 22/udp Crown Copyright 2006 Page 9 of 22

10 SSH or Secure Shell provides a method to log on to systems over a network, move files, execute commands and so on. It utilises strong authentication and encryption to provide security for its communications. SSH is a suitable replacement for legacy services such as telnet, ftp, and the r services (rsh/rdist/rlogin). When correctly configured, SSH secures both the username/password authentication, and any data in transit. SFTP (SSH File Transfer Protocol) is mostly operated as subsystem of SSH- 2. SFTP is a newer and more modern protocol, designed to perform in a manner similar to FTP. It is widely supported, even on non-unix-like platforms, but not nearly as universally as SCP. SFTP (based on SSH) should not be confused with FTPS/Secure FTP (based on SSL); they are distinct protocols which do not interoperate. Unlike SCP, for connection with an SFTP server you do not need access to shell. Thus the SFTP protocol is more independent of the remote operating system. telnet 23/tcp 23/udp Telnet is a clear-text communications protocol. Data is transmitted in the clear; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. Telnet also transmits usernames and passwords in the clear, which could potentially compromise the security of a system. The SSH protocol should be used as a direct replacement for the telnet protocol. smtp 25/tcp 25/udp SMTP is commonly used to send messages between mail servers, and in addition between clients and servers. SMTP does not provide any security features by default, therefore it requires the system administrator to correctly configure appropriate filters and controls within the mail server. Crown Copyright 2006 Page 10 of 22

11 SMTP is a clear text protocol. Data is transmitted in the clear; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. Users should look to other methods such as /data encryption services to provide adequate security for information being transmitted. Software products such as Pretty Good Privacy (PGP) and Gnu Privacy Guard (GPG) offer encryption and digital signing services at the client system. The esmtp protocol offers support for the use of Transport Layer Security (TLS) to secure traffic between mail systems such as MUAs and MTAs. Alternatively, the NHS Contact Service provides a secure method to exchange data via between Contact users. tacacs 49/tcp 49/udp TACACS (Terminal Access Controller Access Control System) is a protocol used to transmit authentication information between a remote access server and an authentication server. Use of TACACS has generally been superseded by newer protocols such as TACACS+ and RADIUS. TACACS transmits authentication information in the clear; therefore it is not recommended for use. Systems administrators should investigate the use of newer authentication protocols. domain 53/tcp 53/udp The Domain Name Server (or DNS) protocol is used to translate domain names into IP addresses. Note that port 53/tcp is used mainly for zone transfers, whereas port 53/udp is commonly used for DNS requests. Most client systems should require only port 53/udp for correct operation. It is good practice to block the 53/tcp zone transfer port if it is not explicitly required. bootps bootpc 67/tcp 67/udp 68/tcp 68/udp The BOOTP protocol is used to provide a system with an IP address. The DHCP protocol performs a similar function and also operates using ports 67 and 68. Crown Copyright 2006 Page 11 of 22

12 Whereas BOOTP/DHCP is common within local network segments, it is generally not considered best practice to forward BOOTP/DHCP requests and responses across Wide-Area Networks or the Internet. Tftp 69/tcp 69/udp The Trivial File Transfer Protocol is a basic legacy protocol used to transfer files between a client and a server. Connections are not authenticated and all communications are made in the clear, therefore the service is not secure. It is not recommended for general use. Some network infrastructure equipment relies on the use of TFTP to store or retrieve configuration information. Network administrators should investigate secure methods of configuration management which are now available to replace the TFTP service. Finger 79/tcp 79/udp Finger is a legacy protocol which allows a user to query a system in order to discover who is logged on. A number of security vulnerabilities are closely linked with the finger service; therefore it is not recommended for use and should be disabled. http 80/tcp 80/udp HTTP is commonly used to allow web browsers to retrieve information from web servers. It can also be used to provide a universal front end for webbased applications. HTTP is a clear text protocol. Data is transmitted in the clear; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. Users should investigate the use of protocols such as SSL and TLS to provide secure communications using HTTP. kerberos 88/tcp 88/udp Crown Copyright 2006 Page 12 of 22

13 Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications. The Kerberos protocol uses strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure network connection. After a client and server have used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business. pop3 110/tcp 110/udp Post Office Protocol version 3 (POP3) is an application layer Internet standard protocol, to retrieve from a remote server over a TCP/IP connection. Most subscribers to individual Internet Service Provider accounts access their with client software that uses POP3, although IMAP support is now emerging as an alternative. POP3 protocol transactions, including electronic mail data, are sent in the clear over the network; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. Users should investigate the use of protocols such as TLS to provide secure communications using POP3. Support for this functionality is available within the POP3 protocol. sunrpc 111/tcp 111/udp Sun's RPC (Remote Procedure Call) forms the basis of many UNIX services, especially NFS (Network File System). However, RPC is vulnerable when left exposed to external networks. The NFS service relies upon the availability of sunrpc for correct operation. If NFS is used, access to the sunrpc port will be required. The NFS service is inherently insecure and therefore should only be utilised within internal networks. The use of Secure NFS is recommended where possible. sftp 115/tcp 115/udp Crown Copyright 2006 Page 13 of 22

14 The Simple File Transfer Protocol as detailed in RFC 913 was proposed as an unsecured file transfer protocol. It is now superseded by a number of other file transfer methods offering better security and additional features. Due to the lack of any security measures within the protocol it should not be used and other alternatives should be investigated. nntp 119/tcp 119/udp The Network News Transfer Protocol or NNTP is an Internet application protocol used primarily for reading and posting Usenet articles, as well as transferring news among news servers. NNTP protocol transactions are sent in the clear over the network; therefore the protocol can expose information such as usernames, passwords and data in transit. NNTPS (Secure NNTP) uses SSL to secure information in transit. It uses 563/tcp instead of 119/tcp. ntp 123/tcp 123/udp The Network Time Protocol (NTP) is a protocol for synchronizing the clocks of computer systems over packet-switched, variable-latency data networks. NTP uses UDP port 123 to transport information. It is designed particularly to resist the effects of variable latency. NTP can be further secured in later versions of the protocol by using authentication methods such as preshared keys, digital certificates and hashing functions. epmap 135/tcp 135/udp The endpoint mapper port (135/udp) is commonly used by the RPC protocol. Remote procedure call (RPC) is a protocol that allows a computer program running on one computer to cause a subroutine on another computer to be executed without the programmer explicitly coding the details for this interaction. When the software in question is written using object-oriented principles, RPC may be referred to as remote invocation or remote method invocation. Crown Copyright 2006 Page 14 of 22

15 The RPC (Remote Procedure Call) was made famous in 2003 by the Blaster Worm virus, which used the protocol to initiate a shutdown of the Windows computer system, without the user's input. This worm caused widespread chaos in the Windows XP community when it was released. Other worms and viruses have since attempted to exploit vulnerabilities in unsecured RPC services, often with some success. Microsoft has adopted DCE/RPC as the basis of their Microsoft RPC (MSRPC) mechanism, and implemented DCOM (and ActiveX) around it. MSRPC is often required for applications such as Microsoft Exchange and Microsoft Active Directory. If RPC access is required it should be either restricted to local LAN segments, or appropriately secured by tunnelling inside an encrypted IPSec or SSL VPN. Netbios -ns Netbios -dgm Netbios -ssn 137/tcp 137/udp 138/tcp 138/udp 139/tcp 139/udp NetBIOS (Network Basic Input/Output System) is a layer of software developed to link a network operating system with specific hardware or software written using the NetBIOS interface. It is used extensively by the Microsoft Operating systems family. NetBIOS is often used as the transport and session services for common tasks such as file and print sharing. Many well known security vulnerabilities exist within both NetBIOS and associated applications, therefore it is not recommended for use outside of private LAN segments. NetBIOS does not natively offer data encryption services, therefore the transmission of sensitive or Patient Identifiable Data should be treated with caution. If NetBIOS access is required across a wide area network or the Internet it should be appropriately secured, most often via the use of an IPSec or SSL VPN tunnel. imap 143/tcp 143/udp Crown Copyright 2006 Page 15 of 22

16 IMAP stands for Internet Message Access Protocol. It is a method of accessing electronic mail or bulletin board messages that are kept on a (possibly shared) mail server. In other words, it permits a "client" program to access remote message stores as if they were local. IMAP protocol transactions, including electronic mail data, are sent in the clear over the network; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. Users should investigate the use of protocols such as TLS to provide secure communications using IMAP. Support for this functionality is available within the IMAP protocol. snmp snmp-trap 161/tcp 161/udp 162/tcp 162/udp The Simple Network Management Protocol (SNMP) is an application layer protocol that facilitates the exchange of management information between network devices. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth. Three versions of SNMP exist: SNMPv1, SNMPv2 and SNMPv3. All versions have a number of features in common, but SNMPv2 offers enhancements such as additional protocol operations whilst the SNMPv3 standard goes further to provide a number of security features. SNMPv3 includes three important services; authentication, privacy, and access control. SNMPv1 and SNMPv2 lack any authentication capabilities, which results in vulnerability to a variety of security threats. These include masquerading occurrences, modification of information, message sequence and timing modifications, and disclosure. SNMPv1 and SNMPv2 also transmit community strings (similar to passwords) in the clear, which could potentially compromise the security of a system or network infrastructure. SNMPv3 provides a much more secure framework for the use of the protocol, and should be utilised in replacement of SNMPv1 and SNMPv2 where possible. It is good practice to restrict the use of SNMP to local network infrastructures. If SNMP access is required to remote devices or systems, the use of IPSec or SSL VPN tunnels should be used. Crown Copyright 2006 Page 16 of 22

17 xdmcp 177/tcp 177/udp The use of XDMCP is inherently insecure; therefore most software distributions ship with XDMCP turned off by default. If the use of XDMCP is required, it should be used only within a trusted local network, such as corporate network within a firewall. XDMCP protocol transactions including any session data are sent in the clear over the network; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material outside of a local LAN segment. Users should investigate the use of protocols such as SSH to provide secure communications using XDMCP. XDMCP uses UDP port 177 and TCP port 6000; therefore, it is not natively able to be used with SSH. Currently, SSH1 and SSH2 implementations are not able to securely forward the UDP communication. To secure the connection with SSH, use X11 TCP/IP Port Forwarding. ldap 389/tcp 389/udp The Lightweight Directory Access Protocol, or LDAP, is a networking protocol for querying and modifying directory services running over TCP/IP. LDAP protocol transactions, including authentication and data, are sent in the clear over the network; therefore the protocol is not suitable for transmission of Patient Identifiable Data or other sensitive material. Users should investigate the use of protocols such as TLS to provide secure communications using LDAP. Support for this functionality is available within the LDAP protocol. See LDAPS within this document for further details. timbuktu 407/tcp 407/udp Timbuktu is a remote control software product developed by a company called Netopia. Remote control software allows a user to control another computer across the local network or the Internet, viewing its screen and using its keyboard and mouse as if he or she were sitting in front of it. Timbuktu is compatible with computers running both Mac OS X and Windows. Crown Copyright 2006 Page 17 of 22

18 Timbuktu was first developed in the late 1980s as a Macintosh product and later was developed for Windows. Timbuktu communicates over TCP port 407, and has integrated support for SSH tunnelling to provide encryption and authentication for control sessions. SSH tunnelling should be used when transporting Patient Identifiable Data or other sensitive information via the Timbuktu protocol. https 443/tcp 443/udp HTTP was originally used in the clear on the Internet. However, increased use of HTTP for sensitive applications has created a requirement for additional security measures. The Secure Sockets layer (SSL) protocol, and its successor the Transport Layer Security (TLS) protocol were designed to provide channel-oriented security. HTTPS with SSL or TLS should be used when Patient Identifiable Data or other sensitive information is to be transported using HTTP methods. rdp 3389/tcp 3389/udp Remote Desktop Protocol (RDP) is a multi-channel protocol that allows a user to connect to a computer running Microsoft Terminal Services. Clients exist for most versions of Windows, and other operating systems such as Linux, FreeBSD, and Mac OS X. The server listens on TCP port 3389 by default. RDP offers support for 128-bit encryption, using the RC4 encryption algorithm. RC4 is the default security mechanism; older clients may use encryption of lesser strength. Some variants of RDP are able to use Transport Layer Security (TLS) to provide encryption and data authentication services. Encryption should be enabled on all sessions that contain Patient Identifiable Data or other sensitive information. vnc 5900/tcp 5900/udp Crown Copyright 2006 Page 18 of 22

19 Virtual Network Computing (VNC) is a desktop sharing system which uses the RFB (Remote FrameBuffer) protocol to remotely control another computer. It transmits the keyboard presses and mouse clicks from one computer to another relaying the screen updates back in the other direction, over a network. VNC by default uses ports 5900 to 5906, each representing the corresponding X screen (ports 5900 to 5906, for screens :0 to :6). By default, VNC is not a secure protocol. While passwords are not sent in plain-text (as in telnet), brute-force cracking could prove successful if both the encryption key and encoded password are sniffed from a network. For this reason it is recommended that a password of at least 8 characters is used. However, VNC may be tunnelled over an SSH or VPN connection which would add an extra security layer with stronger encryption. SSH clients are available for all major platforms (and many smaller platforms as well); SSH tunnels can be created from UNIX clients, Windows clients, Macintosh clients (including OS X and System 7 and up) - and many others. Products such as UltraVNC, RealVNC and Workspot offer additional encryption and authentication services, which help to provide a sufficient level of security for the use of VNC. 4 Glossary ARCFOUR: Also called RC4. A stream cipher, widely used in protocols such as Wired Equivalency Privacy (WEP) and Secure Sockets Layer (SSL). It falls short of modern cryptographic standards but is suitable for practical use in legacy or existing systems. BT: British Telecommunications Plc. The current service provider for the N3 network. BT N3SP: British Telecom N3 Service Provider. N3 is the name for the New NHS Network that will provide wide area networking services to the NHS in England. The NHS has chosen BT as the Service Provider for the N3 network. In this role BT is referred as the N3SP. BTN3SP has formulated the Internet Protocol (IP) addressing policy for N3. HTTPS: Hypertext Transfer Protocol over Secure Socket Layer. A method of using HTTP which moves information using SSL or TLS. It is not a separate protocol but a URI scheme that allows a system to know that HTTP is to be used but with additional security measures applied to the transactions. Crown Copyright 2006 Page 19 of 22

20 IETF: The Internet Engineering Task Force. A large open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. It is open to any interested individual. IP: Internet Protocol. A data oriented communications protocol. IP version 4 is the common element found in today s internet. IPSec: Internet Protocol Security. A method of securing IP communications for security that takes place at the network or packet processing layer of network communication. LAN: Local Area Network. A local computer network for communication between computers; especially a network connecting computers and word processors and other electronic office equipment to create a communication system between offices LSP: Local Service Provider. A provider of LSP Services which has been appointed by the Authority for a Cluster. Responsible for making sure the new systems and services delivered through the NPfIT meet local requirements and are implemented efficiently. N3: The New NHS Network. A private Wide Area Network consisting of thousands of PCs, servers, printers and other items of equipment. Information is unencrypted when transmitted over the network therefore confidentiality of sensitive information within N3 is not assured. NASP: National Application Service Provider. A supplier selected to provide one of the NPfIT national solution services. PID: Patient Identifiable Data. Key identifiable information includes: patient s name, address, full post code, date of birth, pictures, photographs, videos, audio-tapes or other images of patients. PID also encompasses NHS local patient identifiable codes or anything else that could identify a patient directly or indirectly. For example, rare diseases, drug treatments or statistical analyses which have very small numbers within small population may allow the identification of individuals. PKCS#1: Public Key Cryptography Standards. PKCS#1 defines the format of RSA encryption. Crown Copyright 2006 Page 20 of 22

21 PKI: Public Key Infrastructure. Enables users of a basically unsecured public network (such as the internet) to securely and privately exchange data through the use of a public and a private cryptographic key pair, obtained and shared through a trusted authority. The public key infrastructure provides for a digital certificate that can identify an individual or an organization and directory services that can store and, when necessary, revoke the certificates. PPP: Point to Point Protocol. A data transfer protocol which operates at the Data Link Layer. RC4: See ARCFOUR (above). SSH: Secure Shell protocol. Using SSH, a user can log into a server and all of their interactions are tunnelled through an encrypted session so that even if someone intercepts the data, all they will encounter is gibberish. SSL: TCP: Secure Sockets Layer. A protocol designed to provide secure communications across the Internet. Transmission Control Protocol. A protocol that works with IP to ensure that packets travel safely on the Internet. This is the method by which most Internet activity takes place. TLS: Transport Layer Security. A protocol designed to provide secure communications across the Internet designed as a successor to SSL. It uses the same cryptographic methods but supports more cryptographic algorithms. UDP: User Datagram Protocol. A protocol that allows information to be transferred across IP networks. It is similar in operation to TCP; however it lacks the reliability and ordering guarantees, and is stateless. It offers higher performance due to lower overheads in processing and delivery. VPN: Virtual Private Network. A private data network that makes use of the public telecommunication infrastructure; privacy is maintained through the use of a tunnelling protocol and security procedures. Crown Copyright 2006 Page 21 of 22

22 WAN: Wide Area Network. A computer network that spans a relatively large geographical area, typically a WAN consists of two or more local-area networks (LANs). The largest WAN in existence is the internet. WEP: Wired Equivalency Privacy. A security system that uses a series of keys on both sides of a wireless transmission to encrypt data for secure transmission. WEP is not considered secure and there is a range of freely available, pre-existing software programs designed to break its encryption. X.509: The ITU-T standard for Public Key Infrastructure (PKI). It specifies information and attributes required for the identification of a person or a computer system. Crown Copyright 2006 Page 22 of 22